⚠️ Select your experience
The steps to navigating your workspace aware events depend on your interface version. Select a link to skip to the instructions for your version.
Customers who joined Drata on or after Feb 24, 2026 are automatically on the New Experience.
Instructions for the New Experience ⬇️
The Events page shows system activity and test results generated across your Drata environment.
When using Workspaces, some events are workspace-specific, while others remain organization-wide.
Who can access the Events page
You must have one of the following roles:
Admin
Information Security Lead
Workspace Manager
Role restriction
Users with the Risk Manager role cannot access the Events page.
Workspace-aware events
Workspace-aware events are tied to the currently selected Workspace.
These events change when you switch Workspaces using the Workspace picker.
Examples include:
Failed or completed tests
Monitoring-related events
Audit-related test activity
Workspace Managers can view raw test results and evidence for their assigned Workspace(s).
Organization-wide events
Some events always apply to the entire organization and are not tied to a specific Workspace.
Examples include:
Policy creation or updates
Certain access and configuration events
These events appear regardless of which Workspace is selected.
Workspace-aware event categories
You can filter events using Categories. The following categories include workspace-aware events:
Autopilot
⚠️ Some Autopilot events are organization-wide.
Test-related events are workspace-aware.
Monitor
Audit
Report
GRC
Custom Frameworks
Exception
Auditor login events and auditor access logs are always organization-wide, even when other events in the same category are workspace-aware.
Filter and sort events
Filtering behavior is consistent across all Workspaces.
Events are sorted by Timestamp, with the most recent events displayed first.
Switching Workspaces updates the event list automatically for workspace-aware events.
Instructions for the Classic Experience ⬇️
HERE’S WHY
When managing multiple workspaces in Drata, some system events are only applied to those specific workspaces, or business units. For example, you may want to find a specific failed test for Workspace A vs Workspace A, B, and C.
Additionally, it's imperative that users with the ‘Workspace Manager’ role have access to raw test results through the Event Tracking page for their specific workspace(s).
BEFORE DIVING IN
You must have an Admin, Information Security Leads, or Workspace Manager role
You cannot have the Risk Manager role
Some events and ‘Categories’ on the Event Tracking page will remain ‘company-wide’ as they are not applicable to be specific to a single workspace.
HERE’S HOW
As one of the system roles listed above, users are able to navigate to the Event Tracking page as they normally would. Workspace Managers, also have access to this section of the application. As mentioned above, there will be certain events and ‘Categories’ that will be ‘workspace-aware’. Examples are given below:
Workspace Example
Event Tracking: Reviewing a failed test event for a Workspace
Authorized users will be able to view specific events for their workspace and download raw evidence as needed
Company-wide Example
Event Tracking: Reviewing an event where a Policy was created for the company
Workspace-aware Categories
Below you will find a list of workspace-aware categories that you should find specific to the workspace you are in. Categories are the first filter that you can use to filter out specific event categories on the Event Tracking page.
Autopilot
⚠️ Important Note: The Autopilot Category can have both company-wide and workspace-aware events. The events that are workspace-aware are Event Types that have to do anything with Tests (E.g. a failed Test)
Monitor
Audit
Report
GRC
Custom Frameworks
ℹ️ Note: Events that have the categories that are workspace aware, but auditor logs are not. This includes an Auditor logging into the platform directly or when they are granted other accesses with Auditor View.
Sorting
Sorting will remain the same and consistent across all workspaces. The ‘Timestamp’ column will be used to sort events with the most recent event displayed at the top.